Summary

Adds a PreToolUse hook (hooks/socket-gate.ts) for Claude Code that intercepts package install commands and queries the public Socket MCP server before allowing installation.

• Blocks packages with supply chain score below 20 (known malware, typosquats, high-risk signals)
• Supports npm, PyPI, Cargo, RubyGems, Go, and NuGet ecosystems
• No API key, no CLI, no registration — uses https://mcp.socket.dev/ directly
• Fails open on network, parse, and timeout errors so a Socket outage never blocks legitimate work
• Standalone Node.js script using --experimental-strip-types — no build step, no extra deps

Replaces #168 (which used the Socket CLI + API key). Design simplified after review feedback.

Files

Supported commands

How it works

1. Claude Code emits a PreToolUse JSON payload on stdin for every Bash call
2. The hook extracts the package name from recognized install commands
3. It POSTs an MCP initialize then a tools/call for the depscore tool against https://mcp.socket.dev/
4. If supplyChain < 20, it returns deny with a reason that includes the score and a socket.dev review link
5. Anything else (unrecognized command, non-install, network error, parse error) returns allow

Test results

ℹ tests 23
ℹ pass 23
ℹ fail 0

Inspired by Jimmy Vo's dependency hook.